DDFL: dual defense against poisoning attacks in privacy-preserving federated learning.

Abstract

Federated learning (FL) offers a solution to data silos by enabling collaborative training of a global model across decentralized environments. However, when operating with semi-honest servers or malicious clients, traditional FL faces critical privacy and security challenges. Existing defense strategies often struggle to address both privacy and poisoning attacks effectively, as enhanced privacy protections can increase parameter similarity across clients, unintentionally complicating the detection of malicious behavior. Moreover, most poisoning defenses are primarily server-side, resulting in a one-sided approach that is insufficient to handle increasingly sophisticated attack patterns. Therefore, we introduce a dual defense framework against poisoning attacks in privacy-preserving federated learning (DDFL), which effectively tackles both privacy and security challenges in FL. To enhance privacy, we have clients randomly slice and reassemble model parameters before uploading them to the server, thereby safeguarding client privacy without compromising the server's ability to detect potential malicious behaviors in the system. For stronger security, we incorporate meta-learning and knowledge distillation techniques on the client side, alongside Byzantine-robust methods on the server side, effectively mitigating the impact of malicious clients. Extensive evaluations on three benchmark datasets demonstrate that DDFL not only protects clients' sensitive information but also outperforms existing defense strategies in resisting poisoning attacks, achieving higher model accuracy and faster convergence.